2 Accepted solutions
Hi @ajithmurali , glad to see this moving quickly with the Community team.
Just to add a bit of context for anyone else reading: for public apps, client secret rotation isn’t something you can fully self-serve at any time the way you can with private apps. In most cases, HubSpot expects rotation to be coordinated, especially if the app is already installed in multiple portals, to avoid breaking OAuth flows unexpectedly.
The correct path is exactly what’s happening here:
-
Reach out via the Community or Support.
-
Share the App ID privately.
-
HubSpot can assist with generating or resetting the client secret and advising on rollout timing so existing installations keep working.
The docs Seala linked are the right reference points for understanding the OAuth flow and how secrets are handled, but the actual reset often requires human intervention once the app is live. If you’re planning a rotation as part of a security policy, it’s also worth making sure your app supports running with the old and new secrets during a transition window. Sounds like you’re on the right track now.
Did my answer help? Please mark it as a solution to help others find it too.
 | Ruben Burdin HubSpot Advisor Founder @ Stacksync Real-Time Data Sync between any CRM and Database |
 | |
Hi @ajithmurali , glad to see this moving quickly with the Community team.
Just to add a bit of context for anyone else reading: for public apps, client secret rotation isn’t something you can fully self-serve at any time the way you can with private apps. In most cases, HubSpot expects rotation to be coordinated, especially if the app is already installed in multiple portals, to avoid breaking OAuth flows unexpectedly.
The correct path is exactly what’s happening here:
-
Reach out via the Community or Support.
-
Share the App ID privately.
-
HubSpot can assist with generating or resetting the client secret and advising on rollout timing so existing installations keep working.
The docs Seala linked are the right reference points for understanding the OAuth flow and how secrets are handled, but the actual reset often requires human intervention once the app is live. If you’re planning a rotation as part of a security policy, it’s also worth making sure your app supports running with the old and new secrets during a transition window. Sounds like you’re on the right track now.
Did my answer help? Please mark it as a solution to help others find it too.
| | Ruben Burdin HubSpot Advisor Founder @ Stacksync Real-Time Data Sync between any CRM and Database |
| | |
